Threat Hunting Plan

1. Define what is its strategic vision for threat hunting
2. Define its threat hunting process
3. Define the phases of a threat hunt
4. Define the responsibilities of the threat hunters
5. Put them all in one document 🙂
6. https://github.com/rcfontana/ContentSharing
7. https://blogs.gartner.com/john-collins/threathunting/
8. SANs.org Hunting for Evil poster https://www.sans.org/posters/hunt-evil/

Slides from my talk at #EUATTACKworkshop about Threat Hunting Process. Hope it's useful for others 🙂#threathunting pic.twitter.com/ravvMPIeCC

— Renato (@Rcfontana) May 18, 2020

Tools

• OSQuery
  • https://github.com/Kirtar22/ThreatHunting_with_Osquery
• AutoSpy/Basis
• wazuh
• SWIFT
  • https://digital-forensics.sans.org/community/downloads/#overview
• Volatility
  • https://www.volatilityfoundation.org/
• Velociraptor
  • https://www.velocidex.com/blog/html/2019/03/02/agentless_hunting_with_velociraptor.html
• Cobalt Strike
  • https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence
• CrowdStrike searches
  • https://github.com/pe3zx/crowdstrike-falcon-queries